BESA: Boosting Encoder Stealing Attack with Perturbation Recovery
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2025
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866915327450808320 |
|---|---|
| author | Ren, Xuhao Liang, Haotian Wang, Yajie Zhang, Chuan Xiong, Zehui Zhu, Liehuang |
| author_facet | Ren, Xuhao Liang, Haotian Wang, Yajie Zhang, Chuan Xiong, Zehui Zhu, Liehuang |
| contents | To boost the encoder stealing attack under the perturbation-based defense that hinders the attack performance, we propose a boosting encoder stealing attack with perturbation recovery named BESA. It aims to overcome perturbation-based defenses. The core of BESA consists of two modules: perturbation detection and perturbation recovery, which can be combined with canonical encoder stealing attacks. The perturbation detection module utilizes the feature vectors obtained from the target encoder to infer the defense mechanism employed by the service provider. Once the defense mechanism is detected, the perturbation recovery module leverages the well-designed generative model to restore a clean feature vector from the perturbed one. Through extensive evaluations based on various datasets, we demonstrate that BESA significantly enhances the surrogate encoder accuracy of existing encoder stealing attacks by up to 24.63\% when facing state-of-the-art defenses and combinations of multiple defenses. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2506_04556 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | BESA: Boosting Encoder Stealing Attack with Perturbation Recovery Ren, Xuhao Liang, Haotian Wang, Yajie Zhang, Chuan Xiong, Zehui Zhu, Liehuang Cryptography and Security Artificial Intelligence To boost the encoder stealing attack under the perturbation-based defense that hinders the attack performance, we propose a boosting encoder stealing attack with perturbation recovery named BESA. It aims to overcome perturbation-based defenses. The core of BESA consists of two modules: perturbation detection and perturbation recovery, which can be combined with canonical encoder stealing attacks. The perturbation detection module utilizes the feature vectors obtained from the target encoder to infer the defense mechanism employed by the service provider. Once the defense mechanism is detected, the perturbation recovery module leverages the well-designed generative model to restore a clean feature vector from the perturbed one. Through extensive evaluations based on various datasets, we demonstrate that BESA significantly enhances the surrogate encoder accuracy of existing encoder stealing attacks by up to 24.63\% when facing state-of-the-art defenses and combinations of multiple defenses. |
| title | BESA: Boosting Encoder Stealing Attack with Perturbation Recovery |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2506.04556 |